What is your favorite password storage tool? [closed]

Question

Aside from personal passwords, I'm always juggling a number of project-specific passwords, including those for network, web and database authentication. Some authentication can be managed with ssh keys and the like, but everywhere I've worked I also faced the need for the management of passwords that need to be available to a number of different people.

So what do you use, either for personal or team-based password management? Personally I'd like to hear about cross-platform tools, but I'm sure other people would be satisfied with Windows-only solutions. I know the stackoverflow podcast tackled this issue in #7 and #9, but I'm hoping we can come up with the definitive answer here.

Update: Even though this question was asked before its sibling site existed, you should probably add your two cents to the more active question over at superuser, which is a more appropriate venue for this.

Answer 1

KeePass. There are both desktop and flash drive applications. There are both Windows, Linux, and OSX versions, but I believe the flash drive app is Windows only. I could be wrong on that, though.

Answer 2

Password Storage Tools

• KeePass - Windows/Linux/OSX - flash drive version
• Clipperz - Online (Source available for download)
• PasswordMaker - Windows/Linux/OSX - built in to browser or desktop widget
• PasswordSafe
• Keychain Access - built into OSX
• Steganos Locknote
• Passpack - online vault
• CryptoCard Explorer - Windows/Windows Mobile
• Your brain - the only truly secure place to store passwords (unless you're gullible or easily tortured)

Answer 3

Password Safe works for me. Recommended Written by Bruce Schneier

Edit: Also recommended by Joel Spolsky

Answer 4

Does my brain count?

Answer 5

1Password, but it's OSX-only.

Answer 6

I've used the online service Clipperz. The advantage of Clipperz is that it is open source so you can download the code (PHP + MySQL) and host it yourself.

Answer 7

I use PasswordMaker, I heard of it from one of the StackOverflow podcasts a while back and I've been using it ever since. It means I only need to keep one password in my head, and it will generate all my other passwords using a hash of the one in my head with the domain of the site I'm logging on to.

Answer 8

I'm using roboforom and loving it. It's possible to use this for team password storing by syncing the password directory.

Answer 9

Honestly, I just memorize all my passwords. But what I suggest for people less apt to memorize more than one password or people who are less tech savvy is to remember one single password that is strong(at least 8 characters, mixture of letters,numbers,symbols,caps), and then every time they go to a new site/application, choose a password, write it down, then use their memorized password concatenated with the new password. That way even though they have their passwords written down in plain text, maybe even on a post it stuck to their monitor, it is still useless to someone else looking at it.

Answer 10

index card in my wallet. Also endorsed by Bruce Schneier.

Answer 11

LastPass is free and along the same lines as Passpack. Here are some points from their site:

• Create strong passwords, knowing you only have to remember one.
• Log into your favorite sites with a single click
• Fill forms in a second; stop pulling out your wallet to get your credit card number
• Access and manage your data from multiple computers seamlessly
• Securely share logins and notes with friends and let others share with you

Answer 12

OS X's default Keychain ("Keychain Access", and it's what most applications use to store their password)

Answer 13

Passpack, they're really secure (they use Host-Proof hosting, and they actually released a MIT/LGL library that implements it. Here are some of the security features:

• US Government Approved, AES-256 encryption
• Host-Proof Hosting over HTTPS
• Two step login
• Non-Permanent Account Info - All login information can be changed, always.
• Strong Pass-phrases
• Anti-phishing Welcome Message
• Disposable Logins

They also offer two offline versions of the app, one built with AIR, the other one with Gears

Answer 14

Brain cells.

Answer 15

I'm a big fan of Keepass. As far as I know, it's Windows only. It runs on the desktop, so it's not as widely accessible as a Web-based one. OTOH, that means it's less vulnerable.

It also has a built in secure password generator, with rules for length and valid characters, which makes life super easy when you need a new one.

Answer 16

I recently started using SuperGenPass it's a javascript hasher bookmarklet that takes your "master password" and hashes a site password. SuperGenPass has a leg up over the other few in it's class because it has a wonderful interface where you can easily double click the field you want to put the password, and a nice little box in the corner that tells you what's going on.

It's not password storage but it works for me, and for more then webforms.

Answer 17

Commit the damn things to memory. The way you do that is to purposely not ask your software to autofill the password for you. If you have to type the password 5 times per day, you're going to remember it.

That's good for primary passwords.

For all the other passwords, put them online (yahoo notes, google notebook, that sort of thing)

For team passwords: a text file in a restricted directory. make the text file parseable. I personally use this format:

# Format: password number, colon, username, colon, password, colon, date password must be changed by
1:username:password:9/1/2008

This allows the writing of utilities that can parse the file yet make the password list human-editable and legible.

Remember that once a password is stored somewhere beside your brain, it is only a matter of time before unauthorized people gain access to it.

Update: In view of the breach of Sarah Palin's Yahoo Mail account. I think the Yahoo Notes idea is bad.

Answer 18

Keepass is great. Get it from link text then it installs just nicely on a USB key for transportation!

Answer 19

I use Passpack, an online password vault. A big concern with a central place that store all your passwords is security. They handle that with AES encryption. All of your passwords are stored encrypted and decrypted on the fly with a packing key that only know.

Answer 20

Password safe

I have an instance on my home machine and my work machine. I basically just flash-drive to keep them "synched", and just expend the minimum amount of mental energy to ensure that I don't get them out of sync. I'd like something more automated, but how often are you really adding new passwords/usernames?

PW Safe is a Bruce Schneier project.

Answer 21

KeePass. I have it at work, at home, on a USB drive, and it even works on my Blackberry.

Answer 22

I use "Password Keeper" that came on my BlackBerry. I just have to remember that one password, and can backup the database to my PC. I always have my phone with me, so if travelling my passwords are with me for use on a public PC that has USB locked (or has no accessible USB ports)

Answer 23

Keepass is far and away the best I've used.

The greatest thing about it is how many platforms it's available for. Windows, Linux, mobile devices (Blackberry, etc.). What is even more amazing is combining it with Dropbox. You keep your database in your public folder and then the Blackberry app can access the URL of your Keepass dictionary. Your passwords are wherever you go :)

Answer 24

I used Password Safe from Bruce Schneier, but I rewrote it in Java so I could use it under Linux and OSX as well. I called it "Password Tracker" it is completely compatible with the original Password Safe and you can find it in Sourceforge. 8

Answer 25

I've used CryptoCard Explorer which has a Windows and a Windows Mobile client so I can sync the encrypted cards with my phone.

Answer 26

I use Steganos Locknote to store all my logins, passwords, and associated email/security question data. Locknote is essentially Notepad with a password attached. Of course, you have to remember the password to your password file.

Overall, I go out of my way to remember the passwords for sites I use all the time, and don't worry about obscure ones (thats what the text file)

Answer 27

Xecrets, from the developer of AxCrypt. I can't live without that website now. There's two reasons I use this web-based service:

• I trust the developer (I know him, and I've seen the source code)
• I'm going to type those passwords into an input box on another website. Thus, Xecrets is no less secure than the websites receiving my passwords.

Answer 28

Foxmarks which is great for synching your bookmarks in Firefox now does passwords as well. It defaults to off so don't panic if you already use Foxmarks and don't want it touching your passwords.

They do include a wiki entry on how to host your own server.

Here's one of their posts about security of this feature:

We know how sensitive passwords are, so we built this feature with security in mind from the very beginning. In order to synchronize your passwords, Foxmarks will ask you choose a secret PIN that is different from your password. This PIN will be used to encrypt your passwords before synchronization so that your passwords are secured even before they leave your computer. Only you and your computer will have knowledge of this PIN, so nobody but you will be able to decrypt and access your passwords - not even Foxmarks!

If you want to host your own server, there are three settings you should be concerned with in about:config

• foxmarks.url-bookmarks (string)
• foxmarks.url-passwords (string, needs to be a different file)
• foxmarks.useOwnServer (boolean, set to True)

Answer 29

I use Roboform and sync the encrypted files amoungst my machines using Goodsync. This works great although I don't have an Macs - yet!

Answer 30

I use KeePass. You can also use it to encrypt file by adding it as attachment to an entry, but this will increase your database size and make it less portable. Nonetheless, it's a nifty feature to have.